MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.
Run imgdecode?
Get an email when a reviewed story names imgdecode, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A malicious npm package named 'imgdecode' has been discovered, part of the MALFEX supply chain attack campaign. Uploaded to the npm registry by user 'malfexteste8', the package contains a shellcode loader hidden within a Windows native addon. It has been downloaded nearly a thousand times and remains available on the registry.
The lesson from this incident
Full lessonThe 'imgdecode' npm package, part of the MALFEX campaign, demonstrates how threat actors abuse open-source package registries to distribute malware disguised as legitimate developer tools. By embedding a shellcode loader inside a Windows native addon, attackers exploit the inherent trust developers place in third-party dependencies. The package accumulated nearly a thousand downloads before detection, highlighting the danger of insufficient vetting of open-source components. This attack underscores how a single malicious dependency can compromise an entire software supply chain, potentially affecting all downstream users and applications.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- url — https://www.npmjs.com/package/imgdecode
- malware — MALFEX